PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-7392 Autotrace Project CVE debrief

CVE-2016-7392 describes a heap-based buffer overflow in AutoTrace 0.31.1. When pstoedit_suffix_table_init in output-pstoedit.c processes a crafted BMP image, the flaw can cause an out-of-bounds write and denial of service. NVD assigns the issue CVSS 3.0 5.5 (Medium) and maps it to CWE-787.

Vendor
Autotrace Project
Product
Autotrace
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-15
Original CVE updated
2026-05-13
Advisory published
2017-02-15
Advisory updated
2026-05-13

Who should care

Administrators and developers who run or embed AutoTrace 0.31.1, especially in workflows that accept BMP images from untrusted sources, should review exposure and replace or isolate the affected component.

Technical summary

The NVD record identifies a heap-based buffer overflow in pstoedit_suffix_table_init within output-pstoedit.c in AutoTrace 0.31.1. The vulnerable path is reached through a crafted BMP image file. The weakness is classified as CWE-787 (out-of-bounds write). NVD rates the issue CVSS 3.0 5.5 with AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.

Defensive priority

Medium. The main impact is availability loss through process crash or denial of service, with user interaction required according to the CVSS vector.

Recommended defensive actions

  • Identify whether AutoTrace 0.31.1 is installed or embedded in your environment.
  • Update to a fixed release if one is available from the project or your package vendor.
  • Avoid processing untrusted BMP files with affected builds until remediation is in place.
  • Use sandboxing, least privilege, or process isolation for image conversion workflows.
  • Monitor for crashes or abnormal termination in AutoTrace-based conversion jobs.

Evidence notes

Supported by the NVD CVE record and referenced advisories. The CVE description states a heap-based buffer overflow in pstoedit_suffix_table_init in output-pstoedit.c affecting AutoTrace 0.31.1 and triggered by a crafted BMP image file. The NVD record also provides the CVSS vector CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H and CWE-787 classification. References include oss-security posts, a Gentoo advisory, SecurityFocus, and Red Hat bug tracking.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-7392 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-7392

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-7392 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-7392

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.